Get real-time updates on Telegram
CVE-2025-59788: nextcloud server from 30.0.0 (inclusive), before 30.0.17 (exclusive), from 31.0.0 (inclusive), before 31.0.10…
CVE-2025-59788. CVSS 3.1 base score 5.4 (MEDIUM, NVD). EPSS 0.00302 (percentile 0.21466), scored 17-Oct-2026.
Affected technology
nextcloud server · from 30.0.0 (inclusive), before 30.0.17 (exclusive)
nextcloud
nextcloud server · from 31.0.0 (inclusive), before 31.0.10 (exclusive)
nextcloud
nextcloud server · from 32.0.0 (inclusive), before 32.0.1 (exclusive)
nextcloud
nextcloud server · from 22.0.0 (inclusive), before 22.2.10.33 (exclusive)
nextcloud
nextcloud server · from 23.0.0 (inclusive), before 23.0.12.29 (exclusive)
nextcloud
nextcloud server · from 24.0.0 (inclusive), before 24.0.12.28 (exclusive)
nextcloud
nextcloud server · from 25.0.0 (inclusive), before 25.0.13.23 (exclusive)
nextcloud
nextcloud server · from 26.0.0 (inclusive), before 26.0.13.20 (exclusive)
nextcloud
nextcloud server · from 27.0.0 (inclusive), before 27.1.11.20 (exclusive)
nextcloud
nextcloud server · from 28.0.0 (inclusive), before 28.0.14.11 (exclusive)
nextcloud
nextcloud server · from 29.0.0 (inclusive), before 29.0.16.8 (exclusive)
nextcloud
Nextcloud · 0 to before 22.2.10.33, 23 to before 23.0.12.29, 24 to before 24.0.12.28, 25 to before 25.0.13.23, 26 to before 26.0.13.20, 27 to before 27.1.11.20, 28 to before 28.0.14.11, 29 to before 29.0.16.8, 30 to before 30.0.17, 31 to before 31.0.10, 32 to before 32.0.1
Nextcloud
Description’s affected range: versions before 22.2.10.33
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required
What an attacker can do
Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.
- CWE
- CWE-79, CWE-749
- CCR priority
- 21.7 /100 (P4)
- CVSS 3.1
- 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · NVD
- EPSS
- 0.00302 · percentile 0.21466 · 2026-10-17
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-18 15:50:37.644431+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-59788.html